Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b9bdd17dfe53d10…

MALICIOUS

PDF

87.3 KB Created: 2021-04-05 06:19:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 426a9984e9b373ce4d02e6313039e305 SHA-1: 2a481b618044e3b03f956e203936e8cc74590d43 SHA-256: 7b9bdd17dfe53d10cb624ceddd380004436a05c1660376a1212f9edf261f9a9e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a website related to a keyword search. This suggests a phishing or scam attempt, aiming to trick the user into visiting a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for credential harvesting or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=video+guide+for+bozeman+biology+mitosis+answers
    • https://cdn-cms.f-static.net/uploads/4420013/normal_603a0bda14ed7.pdf
    • http://gizigevom.mygamesonline.org/trick_math_questions_and_answers.pdf
    • https://cdn-cms.f-static.net/uploads/4495526/normal_605fa6c7f131e.pdf
    • https://cdn-cms.f-static.net/uploads/4424349/normal_6061fa3399fd3.pdf
    • http://ritegifufefut.scienceontheweb.net/the_easy_5_ingredient_ketogenic_diet_cookbook_download.pdf
    • https://cdn-cms.f-static.net/uploads/4444386/normal_60281fdf2408c.pdf
    • http://kopogaxepaku.sportsontheweb.net/nujorediju.pdf
    • https://cdn-cms.f-static.net/uploads/4380226/normal_60614cffada9c.pdf
    • https://cdn-cms.f-static.net/uploads/4376599/normal_6057db5d89b94.pdf
    • https://static.s123-cdn-static.com/uploads/4452199/normal_5ff145e863450.pdf
    • https://cdn-cms.f-static.net/uploads/4366350/normal_5fdc79ac9301d.pdf
    • http://dusikazo.mypressonline.com/alzheimer_fisiopatologia_2020.pdf
    • http://xajavawinereko.mywebcommunity.org/how_many_episodes_will_attack_on_titan_season_4_have_in_total.pdf
    • http://sipataj.sportsontheweb.net/22314202326.pdf
    • http://okstore.info/beautiful_redemptionyr24u.pdf
    • http://tabikola.online/96289756770htv2r.pdf
    • https://static.s123-cdn-static.com/uploads/4417212/normal_5fcb932652f48.pdf
    • http://vuzetasavuxoso.mygamesonline.org/descargar_examen_toefl.pdf
    • http://card2card-perevod24.site/livret_temoin_de_mariage_a_imprimeraznb2.pdf
    • http://digitaltoolsfor.xyz/dream_hospital_health_care_manager_simulator_mod_apk5ovav.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5dff5267-737a-461b-b4d6-8ba28405728b/2011_rav4_starting_problems.pdf
    • https://uploads.strikinglycdn.com/files/55906ea0-b103-4aa4-a84e-70d131c6eac8/idioms_worksheet_with_answers.pdf
    • https://uploads.strikinglycdn.com/files/6610d8e2-248b-4d4f-bfd9-60fb8361b135/jurareg.pdf
    • https://uploads.strikinglycdn.com/files/f3d2f06f-34d2-4898-b009-718555af2425/lotus_sutra_read_online.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001070a.bin
3130292f2b22a9e9b859b62d319a5926839a12b70c25fbbfe4ee38fbf44cadd7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1070A 5576 bytes
font_01_sfnt_off00011a08.bin
65af1a4159faca75b754168a1b5c01ad73980b7e4aa4090c09dde7efbdbdf906		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A08 3620 bytes
font_02_sfnt_off0001289e.bin
c82a74b0ced84b1af2b7ab58896dcf1023c3e7e625811198f6c5c5af9ccb8bdf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1289E 11356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.